[Midnightbsd-cvs] [MidnightBSD/src] 78baa7: tcp: Fix use-after-free in RACK stack setsockopt h...

[Lucas Holt]

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/src
  Commit: 78baa7439d31e21e9c08466b2c597c5016401562
      https://github.com/MidnightBSD/src/commit/78baa7439d31e21e9c08466b2c597c5016401562
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-06-30 (Tue, 30 Jun 2026)

  Changed paths:
    M sys/netinet/tcp_stacks/rack.c

  Log Message:
  -----------
  tcp: Fix use-after-free in RACK stack setsockopt handler

rack_set_sockopt() drops the connection lock to copy option data from
userspace, then reacquires it.  After reacquiring, it verifies that the
TCP stack had not been switched away (tp->t_fb != &__tcp_rack), but did
not reload its pointer to the stack's per-connection control block.  If
userspace switches stacks twice during this window, the check succeeds
but the saved rack pointer refers to freed memory.

Reload rack from tp->t_fb_ptr after re-validating the stack.

The bug may be exploitable by an unprivileged local user to escalate
privileges.  Only systems that have loaded tcp_rack.ko are affected;
the module is not loaded by default.

Ported from the FreeBSD fix for SA-26:43.tcp (FreeBSD commit
df8885512da5), by Michael Tuexen.

Security:	FreeBSD-SA-26:43.tcp
Security:	CVE-2026-49422
Obtained from:	FreeBSD

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply at anthropic.com>


  Commit: c447ba9ff00b3f2fce2f87279bb24695f4ba8781
      https://github.com/MidnightBSD/src/commit/c447ba9ff00b3f2fce2f87279bb24695f4ba8781
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-06-30 (Tue, 30 Jun 2026)

  Changed paths:
    M UPDATING

  Log Message:
  -----------
  UPDATING: Note SA-26:43.tcp fix

Security:	FreeBSD-SA-26:43.tcp
Security:	CVE-2026-49422

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply at anthropic.com>


Compare: https://github.com/MidnightBSD/src/compare/53e5496159ff...c447ba9ff00b

To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications